@zereight/mcp-gitlab 2.1.70 → 2.2.0

package/build/test/test-update-project.js

@@ -1,112 +0,0 @@
-import { describe, test } from "node:test";
-import assert from "node:assert";
-import { spawn } from "child_process";
-import { MockGitLabServer, findMockServerPort } from "./utils/mock-gitlab-server.js";
-const MOCK_TOKEN = "mock-update-project-token";
-const TEST_PROJECT_ID = "123";
-async function callUpdateProject(args, env) {
-    return new Promise((resolve, reject) => {
-        const proc = spawn("node", ["build/index.js"], {
-            stdio: ["pipe", "pipe", "pipe"],
-            env: { ...process.env, ...env },
-        });
-        let output = "";
-        let errorOutput = "";
-        proc.stdout?.on("data", (d) => (output += d));
-        proc.stderr?.on("data", (d) => (errorOutput += d));
-        proc.on("close", code => {
-            if (code !== 0) {
-                reject(new Error(`Process exited with code ${code}: ${errorOutput}`));
-                return;
-            }
-            const line = output.split("\n").find(l => l.startsWith("{"));
-            if (!line) {
-                reject(new Error("No JSON output found"));
-                return;
-            }
-            const response = JSON.parse(line);
-            if (response.error) {
-                reject(new Error(response.error?.message ?? String(response.error)));
-                return;
-            }
-            const content = response.result?.content?.[0]?.text;
-            resolve(content ? JSON.parse(content) : response.result);
-        });
-        proc.stdin?.end(JSON.stringify({
-            jsonrpc: "2.0",
-            id: 1,
-            method: "tools/call",
-            params: { name: "update_project", arguments: args },
-        }) + "\n");
-    });
-}
-describe("update_project", () => {
-    test("sends project settings to PUT /projects/:id", async () => {
-        const mockPort = await findMockServerPort();
-        const mockServer = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
-        let receivedBody;
-        mockServer.addMockHandler("put", `/projects/${TEST_PROJECT_ID}`, (req, res) => {
-            receivedBody = req.body;
-            res.json({ id: Number(TEST_PROJECT_ID), ...receivedBody });
-        });
-        await mockServer.start();
-        try {
-            const result = await callUpdateProject({
-                project_id: TEST_PROJECT_ID,
-                description: "Managed by MCP",
-                visibility: "private",
-                topics: ["ai", "mcp"],
-                issues_access_level: "enabled",
-                wiki_access_level: "disabled",
-                remove_source_branch_after_merge: "true",
-            }, {
-                GITLAB_API_URL: `${mockServer.getUrl()}/api/v4`,
-                GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-            });
-            assert.deepStrictEqual(receivedBody, {
-                description: "Managed by MCP",
-                visibility: "private",
-                topics: ["ai", "mcp"],
-                issues_access_level: "enabled",
-                wiki_access_level: "disabled",
-                remove_source_branch_after_merge: true,
-            });
-            assert.strictEqual(result.description, "Managed by MCP");
-        }
-        finally {
-            await mockServer.stop();
-        }
-    });
-    test("keeps string false as boolean false", async () => {
-        const mockPort = await findMockServerPort();
-        const mockServer = new MockGitLabServer({ port: mockPort, validTokens: [MOCK_TOKEN] });
-        let receivedBody;
-        mockServer.addMockHandler("put", `/projects/${TEST_PROJECT_ID}`, (req, res) => {
-            receivedBody = req.body;
-            res.json({ id: Number(TEST_PROJECT_ID), ...receivedBody });
-        });
-        await mockServer.start();
-        try {
-            await callUpdateProject({ project_id: TEST_PROJECT_ID, remove_source_branch_after_merge: "false" }, {
-                GITLAB_API_URL: `${mockServer.getUrl()}/api/v4`,
-                GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-            });
-            assert.strictEqual(receivedBody?.remove_source_branch_after_merge, false);
-        }
-        finally {
-            await mockServer.stop();
-        }
-    });
-    test("rejects public access level for non-pages features", async () => {
-        await assert.rejects(() => callUpdateProject({ project_id: TEST_PROJECT_ID, issues_access_level: "public" }, {
-            GITLAB_API_URL: "https://gitlab.example.com/api/v4",
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-        }), /(Invalid enum value|Invalid option)/);
-    });
-    test("rejects empty updates before calling GitLab", async () => {
-        await assert.rejects(() => callUpdateProject({ project_id: TEST_PROJECT_ID }, {
-            GITLAB_API_URL: "https://gitlab.example.com/api/v4",
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-        }), /Provide at least one project setting/);
-    });
-});

package/build/test/test-upload-markdown.js

@@ -1,206 +0,0 @@
-import { describe, test, before, after, beforeEach } from 'node:test';
-import assert from 'node:assert';
-import { spawn } from 'node:child_process';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { MockGitLabServer, findMockServerPort } from './utils/mock-gitlab-server.js';
-const MOCK_TOKEN = 'glpat-mock-token-12345';
-const TEST_PROJECT_ID = '123';
-function callUploadMarkdown(args, env, timeoutMs = 15_000) {
-    return new Promise((resolve, reject) => {
-        const proc = spawn('node', ['build/index.js'], {
-            stdio: ['pipe', 'pipe', 'pipe'],
-            env: { ...process.env, ...env },
-        });
-        const timer = setTimeout(() => {
-            proc.kill();
-            reject(new Error(`Process timed out after ${timeoutMs}ms`));
-        }, timeoutMs);
-        let stdout = '';
-        let stderr = '';
-        proc.stdout?.on('data', (d) => (stdout += d.toString()));
-        proc.stderr?.on('data', (d) => (stderr += d.toString()));
-        proc.on('error', (err) => {
-            clearTimeout(timer);
-            reject(new Error(`Failed to spawn process: ${err.message}`));
-        });
-        proc.on('close', () => {
-            clearTimeout(timer);
-            const lines = stdout.split('\n').filter(l => l.trim().startsWith('{'));
-            for (const line of lines) {
-                try {
-                    const parsed = JSON.parse(line);
-                    if (parsed.id === 1) {
-                        resolve(parsed);
-                        return;
-                    }
-                }
-                catch { /* try next line */ }
-            }
-            reject(new Error(`No matching JSON-RPC response found.\nstdout: ${stdout}\nstderr: ${stderr}`));
-        });
-        proc.stdin?.end(JSON.stringify({
-            jsonrpc: '2.0',
-            id: 1,
-            method: 'tools/call',
-            params: { name: 'upload_markdown', arguments: args },
-        }) + '\n');
-    });
-}
-const MOCK_UPLOAD_RESPONSE = {
-    id: 42,
-    alt: 'test-file.txt',
-    url: '/uploads/abc123secret/test-file.txt',
-    full_path: '/test-group/test-project/uploads/abc123secret/test-file.txt',
-    markdown: '[test-file.txt](/uploads/abc123secret/test-file.txt)',
-};
-let uploadResponse = MOCK_UPLOAD_RESPONSE;
-describe('upload_markdown', () => {
-    let mockGitLab;
-    let env;
-    // Captured per-request state, reset before each invocation via the handler
-    let lastContentType;
-    let lastRawBody;
-    beforeEach(() => {
-        uploadResponse = MOCK_UPLOAD_RESPONSE;
-        lastContentType = undefined;
-        lastRawBody = undefined;
-    });
-    before(async () => {
-        const port = await findMockServerPort();
-        mockGitLab = new MockGitLabServer({ port, validTokens: [MOCK_TOKEN] });
-        await mockGitLab.start();
-        env = {
-            GITLAB_API_URL: `${mockGitLab.getUrl()}/api/v4`,
-            GITLAB_PERSONAL_ACCESS_TOKEN: MOCK_TOKEN,
-        };
-        mockGitLab.addMockHandler('post', `/projects/${TEST_PROJECT_ID}/uploads`, (req, res) => {
-            lastContentType = req.headers['content-type'];
-            const chunks = [];
-            req.on('data', (chunk) => chunks.push(chunk));
-            req.on('end', () => {
-                lastRawBody = Buffer.concat(chunks).toString('binary');
-                res.status(201).json(uploadResponse);
-            });
-        });
-    });
-    after(async () => {
-        await mockGitLab.stop();
-    });
-    test('Content-Type is multipart/form-data with a boundary', async () => {
-        const tmpFile = `mcp-upload-ct-test-${process.pid}.txt`;
-        fs.writeFileSync(tmpFile, 'content-type test');
-        try {
-            await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
-            assert.ok(lastContentType, 'Content-Type header must be present');
-            assert.ok(lastContentType.startsWith('multipart/form-data'), `Expected multipart/form-data, got: ${lastContentType}`);
-            assert.ok(lastContentType.includes('boundary='), `Content-Type must include boundary, got: ${lastContentType}`);
-        }
-        finally {
-            fs.unlinkSync(tmpFile);
-        }
-    });
-    test('multipart body contains a "file" field with the file content', async () => {
-        const tmpFile = `mcp-upload-body-test-${process.pid}.txt`;
-        const fileContent = 'hello from multipart upload test';
-        fs.writeFileSync(tmpFile, fileContent);
-        try {
-            await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
-            assert.ok(lastRawBody, 'Request body must be captured');
-            assert.ok(lastRawBody.includes('name="file"'), 'Multipart body should include a field named "file"');
-            assert.ok(lastRawBody.includes(fileContent), 'Multipart body should contain the uploaded file content');
-        }
-        finally {
-            fs.unlinkSync(tmpFile);
-        }
-    });
-    test('multipart body includes the original filename', async () => {
-        const tmpFile = `mcp-upload-filename-check-${process.pid}.txt`;
-        fs.writeFileSync(tmpFile, 'filename check');
-        try {
-            await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
-            assert.ok(lastRawBody, 'Request body must be captured');
-            assert.ok(lastRawBody.includes(`mcp-upload-filename-check-${process.pid}.txt`), 'Multipart body should include the original filename');
-        }
-        finally {
-            fs.unlinkSync(tmpFile);
-        }
-    });
-    test('returns markdown, url, alt, and full_path from upload response', async () => {
-        const tmpFile = `mcp-upload-response-test-${process.pid}.txt`;
-        fs.writeFileSync(tmpFile, 'response field test');
-        try {
-            const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
-            assert.ok(!raw.error, `Unexpected RPC error: ${raw.error?.message}`);
-            const text = raw.result?.content?.[0]?.text;
-            assert.ok(text, 'Result should contain a text content block');
-            const parsed = JSON.parse(text);
-            assert.strictEqual(parsed.markdown, MOCK_UPLOAD_RESPONSE.markdown);
-            assert.strictEqual(parsed.url, MOCK_UPLOAD_RESPONSE.url);
-            assert.strictEqual(parsed.alt, MOCK_UPLOAD_RESPONSE.alt);
-            assert.strictEqual(parsed.full_path, MOCK_UPLOAD_RESPONSE.full_path);
-        }
-        finally {
-            fs.unlinkSync(tmpFile);
-        }
-    });
-    test('accepts upload responses without id from older self-hosted GitLab', async () => {
-        const { id: _id, ...idlessUploadResponse } = MOCK_UPLOAD_RESPONSE;
-        uploadResponse = idlessUploadResponse;
-        const tmpFile = `mcp-upload-idless-response-test-${process.pid}.txt`;
-        fs.writeFileSync(tmpFile, 'idless response field test');
-        try {
-            const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: tmpFile }, env);
-            assert.ok(!raw.error, `Unexpected RPC error: ${raw.error?.message}`);
-            const text = raw.result?.content?.[0]?.text;
-            assert.ok(text, 'Result should contain a text content block');
-            const parsed = JSON.parse(text);
-            assert.strictEqual(parsed.id, undefined);
-            assert.strictEqual(parsed.markdown, MOCK_UPLOAD_RESPONSE.markdown);
-            assert.strictEqual(parsed.url, MOCK_UPLOAD_RESPONSE.url);
-            assert.strictEqual(parsed.alt, MOCK_UPLOAD_RESPONSE.alt);
-            assert.strictEqual(parsed.full_path, MOCK_UPLOAD_RESPONSE.full_path);
-        }
-        finally {
-            fs.unlinkSync(tmpFile);
-        }
-    });
-    test('returns an error when the file does not exist', async () => {
-        const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: `mcp-upload-missing-${process.pid}.txt` }, env);
-        const hasError = typeof raw.error?.message === 'string' ||
-            raw.result?.content?.some(c => c.text && (c.text.toLowerCase().includes('not found') || c.text.toLowerCase().includes('error')));
-        assert.ok(hasError, 'Should return an error for a nonexistent file path');
-    });
-    test('rejects absolute file_path (path traversal / arbitrary read)', async () => {
-        const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: '/etc/passwd' }, env);
-        const msg = (typeof raw.error?.message === 'string' ? raw.error.message : '') +
-            (raw.result?.content?.map(c => c.text || '').join(' ') || '');
-        assert.ok(msg.toLowerCase().includes('traversal') || msg.toLowerCase().includes('invalid'), `Expected traversal rejection, got: ${msg}`);
-    });
-    test('rejects file_path with ".." traversal', async () => {
-        const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: '../../../etc/passwd' }, env);
-        const msg = (typeof raw.error?.message === 'string' ? raw.error.message : '') +
-            (raw.result?.content?.map(c => c.text || '').join(' ') || '');
-        assert.ok(msg.toLowerCase().includes('traversal') || msg.toLowerCase().includes('invalid'), `Expected traversal rejection, got: ${msg}`);
-    });
-    test('rejects file_path that is a symlink escape', async () => {
-        const linkName = `mcp-upload-symlink-${process.pid}.txt`;
-        const target = path.join(os.tmpdir(), `mcp-upload-secret-${process.pid}.txt`);
-        fs.writeFileSync(target, 'secret-content');
-        fs.symlinkSync(target, linkName);
-        try {
-            const raw = await callUploadMarkdown({ project_id: TEST_PROJECT_ID, file_path: linkName }, env);
-            const msg = (typeof raw.error?.message === 'string' ? raw.error.message : '') +
-                (raw.result?.content?.map(c => c.text || '').join(' ') || '');
-            assert.ok(msg.toLowerCase().includes('symbolic') ||
-                msg.toLowerCase().includes('symlink') ||
-                msg.toLowerCase().includes('escapes') ||
-                msg.toLowerCase().includes('invalid'), `Expected symlink rejection, got: ${msg}`);
-        }
-        finally {
-            fs.rmSync(linkName, { force: true });
-            fs.rmSync(target, { force: true });
-        }
-    });
-});